Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Bill Daskaluk <[e-mail]>]

> "Only about 3.17 percent of the domain names matched," Ristic said. "So we
> have about 22 million SSL servers with certificates that are completely
> invalid because they do not match the domain name on which they reside." 

Is a certificate 'completely invalid' because it does not match the domain?
If a valid certificate is issued to X, and a client connects to what it thinks
is Y and receives a certificate belonging to X, this does not make the
certificate completely invalid -- especially when X and Y share the same
server IP and the client is connecting to the IP, not the domain.

> - X% of web servers properly run SSL (where X will be < 3%)
> - Y% of certificates are valid (where Y will be significantly higher 
> than > 3%)

This conclusion sounds more reasonable as long as "web server" is carefully defined.

Regards,
Bill Daskaluk

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Ivan Ristic
Sent: Tuesday, June 29, 2010 9:32 AM
To: Peter Gutmann
Cc: [e-mail]
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid

The numbers in the article come from the preview of my research, which
I presented in a webcast last Thursday. Here's the summary of the
presentation:

1. I started with 119M domain names (out of 193M registered
worldwide). The 119M include all .com, .org, .net, .info, .biz, and
.us domain names.
2. 92M domains are active on port 80 or port 443
3. 33M domains have port 443 open
4. 22.65M domain names run SSL on port 443
5. On 0.72M domain names certificates match the domain name.

I am now focusing on the 720K certificates that are potentially valid.

Once I find out exactly how many of those certificates are valid, I
will make two claims:

- X% of web servers properly run SSL (where X will be < 3%)
- Y% of certificates are valid (where Y will be significantly higher than > 3%)

I should be able to post my presentation online tomorrow, after which
I will follow-up here.

BTW, my assessment methodology is available on
https://www.ssllabs.com, along with an online assessment tool (that
works with a single hostname). There's additional material on the SSL
Labs mailing list. I will publish the complete report in about a
month.

I welcome all feedback, as well as deeper involvement if you're
interested in the topic.

Cheers,
Ivan

On Tue, Jun 29, 2010 at 8:50 AM, Peter Gutmann
<[e-mail]> wrote:
> In case someone here still hasn't seen this, the subject is a reference to:
>
>  SSL Certificates In Use Today Aren't All Valid
>  http://www.esecurityplanet.com/features/article.php/3890171/SSL-Certificates-In-Use-Today-Arent-All-Valid.htm
>
> which posits that only 3% of SSL certs in use today are valid.  The figures
> seem a bit suspicious though, for example they claim 23 million SSL sites
> while the same article quotes Netcraft as claiming there are 1.5 million SSL
> certs in use (the Netcraft figures may be for CA-issued certs only, since they
> quote Verisign as a percentage of that total).  Still, 3% seems pretty low,
> could this be due to something like virtual hosting and the client not sending
> the hostname, thereby getting the wrong cert?  Even with that though, I
> wouldn't have expected a 97% invalidity rate.
>
> Peter.
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
Ivan Ristic
ModSecurity Handbook [http://www.modsecurityhandbook.com]
SSL Labs [https://www.ssllabs.com/ssldb/]
_______________________________________________
TLS mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tls

---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.